berbew | a50fb5450820003c1ee212faf00a5aa427b11572e0f73f51ebb2a651a96010a3

Analysis

max time kernel
94s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-12-2024 01:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a50fb5450820003c1ee212faf00a5aa427b11572e0f73f51ebb2a651a96010a3.exe
Size

320KB
MD5

9ba34379da51d444928f56cb9aadc19d
SHA1

c991a08b806df786b2c0985e5ebe841aebf3cc9a
SHA256

a50fb5450820003c1ee212faf00a5aa427b11572e0f73f51ebb2a651a96010a3
SHA512

cfabbe11d51d9c14028bf56ff2a3eb2cedc47f326a8114b3b8c8e5589201edd7289d67d0d8533e630554ba84dd4d1ca664ce57a28bb0ba6fe99e30a9eeef625b
SSDEEP

6144:FFz5oyIG1LJp0LAYCtE07kli0KoCYtw2B0Ddu9szWfx09UBIUbPLwH/lLOUaR/N4:HDYJ07kE0KoFtw2gu9RxrBIUbPLwH96G

Score

10^/10

berbew backdoor discovery persistence

Malware Config

Extracted

Family

berbew

http://viruslist.com/wcmd.txt

http://viruslist.com/ppslog.php

http://viruslist.com/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ofnckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ojllan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aqkgpedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bmemac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oflgep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Odmgcgbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pgllfp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ndhmhh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oponmilc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgioqq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acqimo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfbkeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dobfld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odmgcgbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Oddmdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qfcfml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dfknkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bclhhnca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkifae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Anmjcieo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqkgpedc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjmnoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cfbkeh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chagok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chcddk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdcoim32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofnckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Odapnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pqmjog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Anadoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cenahpha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajckij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajfhnjhq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Daekdooc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	a50fb5450820003c1ee212faf00a5aa427b11572e0f73f51ebb2a651a96010a3.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgllfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bganhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dobfld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anadoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aadifclh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cenahpha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	a50fb5450820003c1ee212faf00a5aa427b11572e0f73f51ebb2a651a96010a3.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqmjog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pggbkagp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pgioqq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnfdcjkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cdcoim32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qfcfml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ajckij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aqncedbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bjmnoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bclhhnca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cfpnph32.exe

Berbew
Berbew is a backdoor written in C++.
backdoor berbew
Berbew family
berbew

Executes dropped EXE 64 IoCs

pid	Process
4212	Neeqea32.exe
3976	Npjebj32.exe
4500	Nfgmjqop.exe
3756	Ndhmhh32.exe
2208	Njefqo32.exe
316	Oponmilc.exe
3284	Oflgep32.exe
2068	Odmgcgbi.exe
4024	Ofnckp32.exe
5004	Olhlhjpd.exe
5072	Ojllan32.exe
1568	Odapnf32.exe
1948	Ojoign32.exe
3436	Oddmdf32.exe
1820	Ojaelm32.exe
1556	Pqknig32.exe
4020	Pfhfan32.exe
3244	Pqmjog32.exe
4488	Pggbkagp.exe
4664	Pqpgdfnp.exe
2196	Pgioqq32.exe
4060	Pmfhig32.exe
1104	Pgllfp32.exe
4224	Pnfdcjkg.exe
4940	Pdpmpdbd.exe
2912	Qnhahj32.exe
2652	Qdbiedpa.exe
2412	Qfcfml32.exe
3388	Qnjnnj32.exe
1828	Qcgffqei.exe
5020	Anmjcieo.exe
1128	Aqkgpedc.exe
2204	Ajckij32.exe
4888	Aqncedbp.exe
4448	Aclpap32.exe
4372	Ajfhnjhq.exe
4516	Anadoi32.exe
4464	Aqppkd32.exe
1920	Agjhgngj.exe
5032	Ajhddjfn.exe
3576	Acqimo32.exe
2508	Ajkaii32.exe
4580	Aadifclh.exe
1152	Accfbokl.exe
2200	Bjmnoi32.exe
3148	Bagflcje.exe
1276	Bganhm32.exe
1232	Bnkgeg32.exe
4452	Beeoaapl.exe
4644	Bffkij32.exe
1892	Bnmcjg32.exe
4672	Bcjlcn32.exe
3716	Bjddphlq.exe
3164	Bmbplc32.exe
3456	Bclhhnca.exe
4544	Bfkedibe.exe
440	Bmemac32.exe
1460	Bcoenmao.exe
3520	Cjinkg32.exe
4900	Cmgjgcgo.exe
4056	Cenahpha.exe
652	Cfpnph32.exe
3920	Caebma32.exe
1528	Cdcoim32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ofnckp32.exe	Odmgcgbi.exe
File created	C:\Windows\SysWOW64\Pqknig32.exe	Ojaelm32.exe
File opened for modification	C:\Windows\SysWOW64\Anadoi32.exe	Ajfhnjhq.exe
File created	C:\Windows\SysWOW64\Cdcoim32.exe	Caebma32.exe
File created	C:\Windows\SysWOW64\Fmjkjk32.dll	Cfbkeh32.exe
File created	C:\Windows\SysWOW64\Dfknkg32.exe	Ddmaok32.exe
File created	C:\Windows\SysWOW64\Jdeflhhf.dll	Ndhmhh32.exe
File created	C:\Windows\SysWOW64\Eohipl32.dll	Neeqea32.exe
File opened for modification	C:\Windows\SysWOW64\Ajfhnjhq.exe	Aclpap32.exe
File created	C:\Windows\SysWOW64\Bmemac32.exe	Bfkedibe.exe
File opened for modification	C:\Windows\SysWOW64\Neeqea32.exe	a50fb5450820003c1ee212faf00a5aa427b11572e0f73f51ebb2a651a96010a3.exe
File opened for modification	C:\Windows\SysWOW64\Cdcoim32.exe	Caebma32.exe
File opened for modification	C:\Windows\SysWOW64\Odapnf32.exe	Ojllan32.exe
File created	C:\Windows\SysWOW64\Ojaelm32.exe	Oddmdf32.exe
File created	C:\Windows\SysWOW64\Chagok32.exe	Ceckcp32.exe
File created	C:\Windows\SysWOW64\Oddmdf32.exe	Ojoign32.exe
File created	C:\Windows\SysWOW64\Dobfld32.exe	Dfknkg32.exe
File created	C:\Windows\SysWOW64\Bagflcje.exe	Bjmnoi32.exe
File opened for modification	C:\Windows\SysWOW64\Danecp32.exe	Dfiafg32.exe
File opened for modification	C:\Windows\SysWOW64\Ddonekbl.exe	Dobfld32.exe
File created	C:\Windows\SysWOW64\Bjddphlq.exe	Bcjlcn32.exe
File opened for modification	C:\Windows\SysWOW64\Aadifclh.exe	Ajkaii32.exe
File created	C:\Windows\SysWOW64\Mkijij32.dll	Cmgjgcgo.exe
File created	C:\Windows\SysWOW64\Pkmlea32.dll	Qcgffqei.exe
File opened for modification	C:\Windows\SysWOW64\Qcgffqei.exe	Qnjnnj32.exe
File created	C:\Windows\SysWOW64\Oflgep32.exe	Oponmilc.exe
File created	C:\Windows\SysWOW64\Lnlden32.dll	Pgllfp32.exe
File created	C:\Windows\SysWOW64\Ajckij32.exe	Aqkgpedc.exe
File created	C:\Windows\SysWOW64\Ldfgeigq.dll	Accfbokl.exe
File created	C:\Windows\SysWOW64\Pnfdcjkg.exe	Pgllfp32.exe
File created	C:\Windows\SysWOW64\Pfhfan32.exe	Pqknig32.exe
File opened for modification	C:\Windows\SysWOW64\Qnjnnj32.exe	Qfcfml32.exe
File opened for modification	C:\Windows\SysWOW64\Anmjcieo.exe	Qcgffqei.exe
File opened for modification	C:\Windows\SysWOW64\Aclpap32.exe	Aqncedbp.exe
File created	C:\Windows\SysWOW64\Aqppkd32.exe	Anadoi32.exe
File created	C:\Windows\SysWOW64\Mjelcfha.dll	Dobfld32.exe
File created	C:\Windows\SysWOW64\Dkifae32.exe	Ddonekbl.exe
File created	C:\Windows\SysWOW64\Neeqea32.exe	a50fb5450820003c1ee212faf00a5aa427b11572e0f73f51ebb2a651a96010a3.exe
File created	C:\Windows\SysWOW64\Cnkplejl.exe	Chagok32.exe
File created	C:\Windows\SysWOW64\Igjnojdk.dll	Pqknig32.exe
File created	C:\Windows\SysWOW64\Flgehc32.dll	Cenahpha.exe
File created	C:\Windows\SysWOW64\Jjjald32.dll	Danecp32.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Dhocqigp.exe
File created	C:\Windows\SysWOW64\Olhlhjpd.exe	Ofnckp32.exe
File created	C:\Windows\SysWOW64\Hjfhhm32.dll	Cjinkg32.exe
File created	C:\Windows\SysWOW64\Jpcmfk32.dll	Pnfdcjkg.exe
File created	C:\Windows\SysWOW64\Cogflbdn.dll	Ddmaok32.exe
File created	C:\Windows\SysWOW64\Daekdooc.exe	Dkkcge32.exe
File created	C:\Windows\SysWOW64\Jjlogcip.dll	Bmbplc32.exe
File opened for modification	C:\Windows\SysWOW64\Ajckij32.exe	Aqkgpedc.exe
File created	C:\Windows\SysWOW64\Ddmaok32.exe	Danecp32.exe
File created	C:\Windows\SysWOW64\Pmfhig32.exe	Pgioqq32.exe
File created	C:\Windows\SysWOW64\Anmjcieo.exe	Qcgffqei.exe
File created	C:\Windows\SysWOW64\Aqkgpedc.exe	Anmjcieo.exe
File created	C:\Windows\SysWOW64\Pkejdahi.dll	Ajckij32.exe
File opened for modification	C:\Windows\SysWOW64\Bffkij32.exe	Beeoaapl.exe
File opened for modification	C:\Windows\SysWOW64\Bnmcjg32.exe	Bffkij32.exe
File opened for modification	C:\Windows\SysWOW64\Bmbplc32.exe	Bjddphlq.exe
File created	C:\Windows\SysWOW64\Pqpgdfnp.exe	Pggbkagp.exe
File created	C:\Windows\SysWOW64\Oncmnnje.dll	Pfhfan32.exe
File opened for modification	C:\Windows\SysWOW64\Bganhm32.exe	Bagflcje.exe
File opened for modification	C:\Windows\SysWOW64\Cnkplejl.exe	Chagok32.exe
File created	C:\Windows\SysWOW64\Ldamee32.dll	Oddmdf32.exe
File created	C:\Windows\SysWOW64\Jlklhm32.dll	Anadoi32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1600	2156	WerFault.exe	167

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Neeqea32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqppkd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daconoae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgllfp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajhddjfn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dobfld32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhmgki32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oponmilc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Olhlhjpd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pgioqq32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qfcfml32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqkgpedc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Acqimo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajkaii32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjmnoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Njefqo32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oflgep32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Oddmdf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddmaok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cenahpha.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chcddk32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cegdnopg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Danecp32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjddphlq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfpnph32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cmqmma32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aclpap32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Beeoaapl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmemac32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chagok32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ddonekbl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqknig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qdbiedpa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajckij32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Daekdooc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bcjlcn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ceehho32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dkifae32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojoign32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnkgeg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bnmcjg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nfgmjqop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odapnf32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ajfhnjhq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pnfdcjkg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qnjnnj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anmjcieo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a50fb5450820003c1ee212faf00a5aa427b11572e0f73f51ebb2a651a96010a3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Odmgcgbi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojllan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bagflcje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cjinkg32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ojaelm32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pmfhig32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bmbplc32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Aqncedbp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anadoi32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Agjhgngj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pfhfan32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pqmjog32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Qnhahj32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cfbkeh32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cnkplejl.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Anmjcieo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bjddphlq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcbdhp32.dll"	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Oddmdf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ojaelm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pgioqq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Daconoae.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nfgmjqop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Oflgep32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ajckij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Odmgcgbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Papbpdoi.dll"	Qfcfml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Anadoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ajfhnjhq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Njefqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jocbigff.dll"	Pggbkagp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pmfhig32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Olhlhjpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pgioqq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pdpmpdbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qcgffqei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dhmgki32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dhocqigp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ceckcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	a50fb5450820003c1ee212faf00a5aa427b11572e0f73f51ebb2a651a96010a3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aqkgpedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Qnjnnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjjdjk32.dll"	Bnmcjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpcnha32.dll"	Bjddphlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cjinkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfdjmlhn.dll"	Olhlhjpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clncadfb.dll"	Odapnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmphmhjc.dll"	Pdpmpdbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qoqbfpfe.dll"	Aqkgpedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ajkaii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhqeiena.dll"	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cogflbdn.dll"	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dobfld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eohipl32.dll"	Neeqea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehfnmfki.dll"	Anmjcieo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bganhm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aqkgpedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bmemac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cnkplejl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Oponmilc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ojoign32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Oddmdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Acqimo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mogqfgka.dll"	Bfkedibe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aadifclh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Chcddk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dfiafg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ojllan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pfhfan32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pqpgdfnp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 4212	5056	a50fb5450820003c1ee212faf00a5aa427b11572e0f73f51ebb2a651a96010a3.exe	82
PID 5056 wrote to memory of 4212	5056	a50fb5450820003c1ee212faf00a5aa427b11572e0f73f51ebb2a651a96010a3.exe	82
PID 5056 wrote to memory of 4212	5056	a50fb5450820003c1ee212faf00a5aa427b11572e0f73f51ebb2a651a96010a3.exe	82
PID 4212 wrote to memory of 3976	4212	Neeqea32.exe	83
PID 4212 wrote to memory of 3976	4212	Neeqea32.exe	83
PID 4212 wrote to memory of 3976	4212	Neeqea32.exe	83
PID 3976 wrote to memory of 4500	3976	Npjebj32.exe	84
PID 3976 wrote to memory of 4500	3976	Npjebj32.exe	84
PID 3976 wrote to memory of 4500	3976	Npjebj32.exe	84
PID 4500 wrote to memory of 3756	4500	Nfgmjqop.exe	85
PID 4500 wrote to memory of 3756	4500	Nfgmjqop.exe	85
PID 4500 wrote to memory of 3756	4500	Nfgmjqop.exe	85
PID 3756 wrote to memory of 2208	3756	Ndhmhh32.exe	86
PID 3756 wrote to memory of 2208	3756	Ndhmhh32.exe	86
PID 3756 wrote to memory of 2208	3756	Ndhmhh32.exe	86
PID 2208 wrote to memory of 316	2208	Njefqo32.exe	87
PID 2208 wrote to memory of 316	2208	Njefqo32.exe	87
PID 2208 wrote to memory of 316	2208	Njefqo32.exe	87
PID 316 wrote to memory of 3284	316	Oponmilc.exe	88
PID 316 wrote to memory of 3284	316	Oponmilc.exe	88
PID 316 wrote to memory of 3284	316	Oponmilc.exe	88
PID 3284 wrote to memory of 2068	3284	Oflgep32.exe	89
PID 3284 wrote to memory of 2068	3284	Oflgep32.exe	89
PID 3284 wrote to memory of 2068	3284	Oflgep32.exe	89
PID 2068 wrote to memory of 4024	2068	Odmgcgbi.exe	90
PID 2068 wrote to memory of 4024	2068	Odmgcgbi.exe	90
PID 2068 wrote to memory of 4024	2068	Odmgcgbi.exe	90
PID 4024 wrote to memory of 5004	4024	Ofnckp32.exe	91
PID 4024 wrote to memory of 5004	4024	Ofnckp32.exe	91
PID 4024 wrote to memory of 5004	4024	Ofnckp32.exe	91
PID 5004 wrote to memory of 5072	5004	Olhlhjpd.exe	92
PID 5004 wrote to memory of 5072	5004	Olhlhjpd.exe	92
PID 5004 wrote to memory of 5072	5004	Olhlhjpd.exe	92
PID 5072 wrote to memory of 1568	5072	Ojllan32.exe	93
PID 5072 wrote to memory of 1568	5072	Ojllan32.exe	93
PID 5072 wrote to memory of 1568	5072	Ojllan32.exe	93
PID 1568 wrote to memory of 1948	1568	Odapnf32.exe	94
PID 1568 wrote to memory of 1948	1568	Odapnf32.exe	94
PID 1568 wrote to memory of 1948	1568	Odapnf32.exe	94
PID 1948 wrote to memory of 3436	1948	Ojoign32.exe	95
PID 1948 wrote to memory of 3436	1948	Ojoign32.exe	95
PID 1948 wrote to memory of 3436	1948	Ojoign32.exe	95
PID 3436 wrote to memory of 1820	3436	Oddmdf32.exe	96
PID 3436 wrote to memory of 1820	3436	Oddmdf32.exe	96
PID 3436 wrote to memory of 1820	3436	Oddmdf32.exe	96
PID 1820 wrote to memory of 1556	1820	Ojaelm32.exe	97
PID 1820 wrote to memory of 1556	1820	Ojaelm32.exe	97
PID 1820 wrote to memory of 1556	1820	Ojaelm32.exe	97
PID 1556 wrote to memory of 4020	1556	Pqknig32.exe	98
PID 1556 wrote to memory of 4020	1556	Pqknig32.exe	98
PID 1556 wrote to memory of 4020	1556	Pqknig32.exe	98
PID 4020 wrote to memory of 3244	4020	Pfhfan32.exe	99
PID 4020 wrote to memory of 3244	4020	Pfhfan32.exe	99
PID 4020 wrote to memory of 3244	4020	Pfhfan32.exe	99
PID 3244 wrote to memory of 4488	3244	Pqmjog32.exe	100
PID 3244 wrote to memory of 4488	3244	Pqmjog32.exe	100
PID 3244 wrote to memory of 4488	3244	Pqmjog32.exe	100
PID 4488 wrote to memory of 4664	4488	Pggbkagp.exe	101
PID 4488 wrote to memory of 4664	4488	Pggbkagp.exe	101
PID 4488 wrote to memory of 4664	4488	Pggbkagp.exe	101
PID 4664 wrote to memory of 2196	4664	Pqpgdfnp.exe	102
PID 4664 wrote to memory of 2196	4664	Pqpgdfnp.exe	102
PID 4664 wrote to memory of 2196	4664	Pqpgdfnp.exe	102
PID 2196 wrote to memory of 4060	2196	Pgioqq32.exe	103

C:\Users\Admin\AppData\Local\Temp\a50fb5450820003c1ee212faf00a5aa427b11572e0f73f51ebb2a651a96010a3.exe
"C:\Users\Admin\AppData\Local\Temp\a50fb5450820003c1ee212faf00a5aa427b11572e0f73f51ebb2a651a96010a3.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Windows\SysWOW64\Neeqea32.exe
  C:\Windows\system32\Neeqea32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Windows\SysWOW64\Npjebj32.exe
    C:\Windows\system32\Npjebj32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3976
  - - C:\Windows\SysWOW64\Nfgmjqop.exe
      C:\Windows\system32\Nfgmjqop.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4500
    - - C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3756
      - C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2208
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:316
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3284
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2068
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4024
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5004
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5072
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1568
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1948
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3436
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1820
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1556
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4020
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3244
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4488
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4664
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2196
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        23⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4060
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1104
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4224
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4940
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        27⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2912
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        28⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2652
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2412
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3388
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1828
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5020
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1128
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2204
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4888
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4448
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4372
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4516
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        39⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4464
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1920
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        41⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5032
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3576
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2508
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4580
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1152
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2200
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3148
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1276
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        49⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1232
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4452
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4644
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        52⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1892
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4672
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3716
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3164
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3456
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4544
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:440
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1460
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3520
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4900
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4056
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:652
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3920
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1528
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5044
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2324
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        68⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4832
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:348
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3084
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4628
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4236
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4100
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        74⤵
        System Location Discovery: System Language Discovery
        
        PID:3124
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:2272
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        76⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:5028
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:2924
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3960
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3772
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        80⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:852
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:1852
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        82⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3676
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        83⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1264
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3136
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        System Location Discovery: System Language Discovery
        
        PID:760
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        86⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1440
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        87⤵
        System Location Discovery: System Language Discovery
        
        PID:2156
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 436
        88⤵
        Program crash
        
        PID:1600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2156 -ip 2156
1⤵
PID:4648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ajkaii32.exe

Filesize
320KB

MD5
74804830f3b45efdbddaa3ce7738140a

SHA1
10e85f32655ea62bd397f21e2b9b97ba4fc73bae

SHA256
bc2f2a552a50937694de2f595f09283d4af597ee6c459c805be71f724d202883

SHA512
b284b5883a868a1686bd9ec897dc410526834e0e81e17a231ae302ddc9b7b97627c4f92b2891fabf86d562d20214246adf44ee2577111554266ee6a4219398b4

Download Submit
C:\Windows\SysWOW64\Anmjcieo.exe

Filesize
320KB

MD5
6667142ace5add8e2d163995cf319433

SHA1
71b325de37cb2fa005a32708195987324f1d5bc9

SHA256
aa576f74fd6301e17db6e4720bfef58e2f802ec93688c5d1792ba8ee08e94f40

SHA512
6374568ebc4470aa0bd055c3d66b9cec7d09b0b1b13df6ae0aadfcda4d7d70dd06e04591a23b335ebf56d9568f56e0e63b34794a42d5e8289ea017b946b61b3c

Download Submit
C:\Windows\SysWOW64\Aqkgpedc.exe

Filesize
320KB

MD5
1f22eefc85240c4659ad3a229575107e

SHA1
0d47518b8c1a5a5e9f5b39ae52dca087cf0360e0

SHA256
8cac172a813d69afa6bdf7bd7654236730610cdd5c0535b7c1558c75f32ab282

SHA512
4e874469781a45df7677f702dc90f795062108cbadf77d12f6aa8d0afa4bc38b9c0be46240cdb1489cf1ca3ec1b598fd2d32ba387d1789233fb3ab87d33939d4

Download Submit
C:\Windows\SysWOW64\Aqppkd32.exe

Filesize
320KB

MD5
5ac4136b18c38952b3c31d36ae77d68d

SHA1
93ad944836a9d90585dbf1dff2233f245abc439c

SHA256
3f2d5a30584e627619f28e42b88f5b18f62d127fa991335e02d0bb757c3fa6bf

SHA512
d362346746dd69e449cc60257e67977e152c13e51931493b0d1e08cb5565c46d3f27c5618bf0b8df4e7e689b9c40649e24ef4d3140869d1df4b994d1b75b1e49

Download Submit
C:\Windows\SysWOW64\Bagflcje.exe

Filesize
320KB

MD5
540131a4733af4c35891f6920c271a0f

SHA1
635351e32709ebb62bb00ffced6ffbcba5dbadc4

SHA256
f7e1184dfb055a8918bfd6158f2f5843fe6bf3b2df57d157f90d5dc2e46a4baa

SHA512
5e65594806596a009ed42723e2cbd0f9d1f8202dc66558a23d35ff6899936b04800e039349a680326bc651e567f4f7bbe7d0bc1e0eeb1159eb6bc333f6c00178

Download Submit
C:\Windows\SysWOW64\Bcjlcn32.exe

Filesize
320KB

MD5
2edf0c3d86188317783431b02650b1cd

SHA1
ae7c3e40421235762148d989cbfd4e08481c9c41

SHA256
30783ae5c6e6793e7e65a7827fad28070111544deb63c92081b4acb5e1c5e701

SHA512
36a67a8167a4c37266a8f4c7a717431930c70ee95080e510d2f64a1ee4c5fd39d35557a2d83bf367dcd59a79fe73bfb1eb185ab5d99890d0d77291b8af88c0ce

Download Submit
C:\Windows\SysWOW64\Bcoenmao.exe

Filesize
320KB

MD5
7e63fb5ac3f051e28cdfb61c3421647a

SHA1
2836ed866d0177c78598d73154e03e3e81eb37c9

SHA256
bad3cdf089efaf94c229c60646830b5fe2df1d53d31bb1a082edb17a99fbaa2e

SHA512
039970de6562632d59ea9967e4af8f8ffdf2794a38c62fc4a6e0031f5d8294feb25e38a4409512493f9707852fef0388dcfc8002e850a147bc64b3b8699e9d4e

Download Submit
C:\Windows\SysWOW64\Cfbkeh32.exe

Filesize
64KB

MD5
d9f17c3a3fd69e2a0b1edc742ae5757c

SHA1
f071c11a9d90b767f0658127f3e67eed3c890021

SHA256
fd059eb6d0e43cb038bee7a8817f5f4310dbdc9719ed215f51158996dc590dfb

SHA512
22097e108c9f4bb1cbe36dfcb13ba7d7a22fff0cede3712e84738e213d9b240d907b3b2c282fe5e4a4e0e2b4f8c926f39c5c923d9719d4096d0cccdc83aead1c

Download Submit
C:\Windows\SysWOW64\Cfpnph32.exe

Filesize
128KB

MD5
5579c5f722cdc3733d5a95c322b13202

SHA1
e20137f1b075cdca7e9a4929e6fe00847f1c6778

SHA256
ac8e7572e627fddbd5862586b70ed5891b85bd458a1ce05fe2de50d9bdb8d0ab

SHA512
10904bdd420cbe6af7221be3442a9888e2eb75454f2d3855e98561297161ab1bc545ff7aefb9b668bd371d82c0e4969f2427f3deb86ceb840447fdceef905727

Download Submit
C:\Windows\SysWOW64\Ddonekbl.exe

Filesize
320KB

MD5
c5b08b41654ae6321f87485868dcbc61

SHA1
cd928bf123a7bf56607112a67923993e692915cc

SHA256
377d4106ddf2781f214cc24c2fe0ae59a69d8bc316d3def8f0d9d09638215f30

SHA512
0b3256b857e92381b24e06dceed3d22b14b1e67ef64ffca549b3176a93916d35c027c87d5f50b9d3c3f4453634b5ac48b5e4874d66052827817fe27bf00afd29

Download Submit
C:\Windows\SysWOW64\Dfiafg32.exe

Filesize
320KB

MD5
cc63cdd2e16e2bac62c2f2c1fb1c48ee

SHA1
a6b836d6304951478310479040506c9e6417d54e

SHA256
129b13b32caeef562a32a1825b0109ae7af3b14afdff0ae46cac4815b85642d5

SHA512
e618801e0a0a96b4f6f8639bcce47d9bfb4eb7c9d56893cbf6906ef435ae1f01c609af39e4d249f78fb674f737ff98eacc48b703ebccd38d939c11bfcd261eff

Download Submit
C:\Windows\SysWOW64\Jdeflhhf.dll

Filesize
7KB

MD5
fe02b8ac6fc55a6fa3046ec222ef9fb3

SHA1
d7014278f73bd0a29d1c32ac6b15fd92166a87ca

SHA256
4d860271ea25e4dcb54ea7251ebdb9e6c175c1c4846944f4ed4cae6df1c76ca4

SHA512
c174de31e2baef6755191dbeab305107e39eb3800431b0577430ac57f9cb2f5e4e4d3268e92083da761d314df4204b41b532784e5e453b3e552161a7fd162c51

Download Submit
C:\Windows\SysWOW64\Ndhmhh32.exe

Filesize
320KB

MD5
2f0ce38165a4792e0f167d7ce132f117

SHA1
ec8f5dff5f8fc7c331b4e658bbedc43c7c1a71b6

SHA256
22026d275d9067e829770d00d3104058d9ea0f26f10718becce5b2c0408712ea

SHA512
adc023861c8a8d523c88c976f050f16181ffe74bc795f954c0e814aeec557dbbf591deca89b9f5fe2c50a20d1031cc664a57d8ad7256bc8236e2b0d528951477

Download Submit
C:\Windows\SysWOW64\Neeqea32.exe

Filesize
320KB

MD5
883f1fc1459150a781d46c04624508b6

SHA1
e81741a26a10d0db3004911b3760a04142912e81

SHA256
4de2ec2b5419ff2b70503c789a7225677a1d565fef730dbdfdddb59ae03239fd

SHA512
901c1fcf99ee6ef933cd240f1bdcf9f18bad9944f51ed3915db1de404b5f22718c2841bb6ca4f858e416b763590ae0d7f056cc04b7ed1a08956eb5d13956fb93

Download Submit
C:\Windows\SysWOW64\Nfgmjqop.exe

Filesize
192KB

MD5
fb36ced094c8bccec22a4e9a1bd5eb34

SHA1
6e33b734bbd6255dfdb3d5b65394d77dc4f7f0bc

SHA256
534497e777409cebf053dc552257a397bdb86a2cadc2078350a21d1e13cf11b8

SHA512
aed640d2239b27c3cbbf847617e2b4a1037d9bfa6113ff658da736077ba3fd1c33a18781ab06193e7848485af8a09eb51a38e7fcf602b5ba4ac439ddf4e6132c

Download Submit
C:\Windows\SysWOW64\Nfgmjqop.exe

Filesize
320KB

MD5
ac27751edff3d5758e756c75b61df710

SHA1
50c373e9f91512a29e73bc5e50557654bd43951f

SHA256
06dda2c89cb38fa0843e799cf5cf240a7a888a69630d01d07253b095e8a0176d

SHA512
10609e97d484cc18e87551650eb2b1bf347b68a997d863311cdce987bb2664241017081ac56f6ddc863ee854e2c111021a4efa9be8155859b1fd37e95a46d543

Download Submit
C:\Windows\SysWOW64\Njefqo32.exe

Filesize
320KB

MD5
ddb5a9d37a864fe602fd5650d8abd9df

SHA1
9ae01606e21bc373c1aaebec4e96a2ee1ef28154

SHA256
8a4360e4485fcec177146b2cebba7c801a01688393379656c3f641ac6861725a

SHA512
8833c4014322c54039323d2f8aadd2ae07eb87c01d8477a6e9c5d71dea5d15ad5fe0baafc35a0d0c86d1fa7083ccb7e844ffeb992faf25fe0e3be74b79b393cc

Download Submit
C:\Windows\SysWOW64\Npjebj32.exe

Filesize
320KB

MD5
65529b5069828cdd44baae9ff0f5f069

SHA1
b319043bd52a951fc06cca50a7845e798b0c643a

SHA256
7039d7d365bca952ea3125d2abe38dec8e292bee09987cfd3b8585bb9876af4b

SHA512
a8fecc40f32365e6093a741b4e10776f74f27a142584d695e25d51beab72e97cd17a2fcac7db4a5b5f123a9216219701f6b3fd6479e7916b556db66e40eb923b

Download Submit
C:\Windows\SysWOW64\Odapnf32.exe

Filesize
320KB

MD5
11dad9b3b401ee4065b0dbb841fcbe33

SHA1
08c029c8fe6a74113a92d89d90a032d4f4389dc2

SHA256
87196d4eed332bc213918f4d1dcc0218def9cd8b25e063505faad0374420c9ac

SHA512
1a0125909c8cb3259ac329f809b0cc02180a8290e32915f04bde3c1b22eefd21f7c45f7b7ffee6897aeca60098ff2fa191635a4cacdb7cf43ef77a3a2a48fa50

Download Submit
C:\Windows\SysWOW64\Oddmdf32.exe

Filesize
320KB

MD5
e2768d3c277b310a11f70718a6599d3a

SHA1
d6284941bd919ed7edb26ff4c1b6ad746c5b2e42

SHA256
07a885cf96391c4c80dedd00333ece4319f0091b5013d0ac0ea716368766cb99

SHA512
86cdba028e35948f138c05145b4d96c069f3b63059f84428407943713d3722c6d65fd3de569851ad841f89493cb92bc205c178b30f5643d67257de62b36e4c0f

Download Submit
C:\Windows\SysWOW64\Odmgcgbi.exe

Filesize
320KB

MD5
9ba37c9f8b64d0c7aea502c6b4d16f9d

SHA1
caa31359c9ab842d4076d021f4d863bf0785be09

SHA256
cdabd0a00f45aad9f45db0ee85af0d35d7f522a3f5221406dd3e0dedc752212e

SHA512
e98be41c159057271f92b9a52bbc72235283a35d83543b39dd5739319df995eabb2d9306ddeba66b59886b30d3140f9abdd5c564cf180b841e9caeb9973c0d1a

Download Submit
C:\Windows\SysWOW64\Odmgcgbi.exe

Filesize
320KB

MD5
e4d4004e8649972abcb770665e07a334

SHA1
d923aebbe198c19732f8c048ecd61d22203fd181

SHA256
4933284caa6c672c5fa59d85d10776532bf7223819e0eb7289ef2323ff09729a

SHA512
ee30ede52e49a98a4f52fe7bc83c02dbb7bb8674907e501a894e57132d74788d1cd30d56831a4563b449ed337bd6db6173a120f9ad6b9fbdc4192e64731eb4f6

Download Submit
C:\Windows\SysWOW64\Oflgep32.exe

Filesize
320KB

MD5
0968131dbb3488aa12813e90f3b658b2

SHA1
e5bebb3f25dbb11e23c91b5004e3722c13f7202b

SHA256
641303ba084fd039dee53fab2e6489a1b374b0698f28c6652f060eb03b35e60b

SHA512
4ffee2d0ae17d7eddb77b1e0430152660377572042ece14b9aabe341135e32a42ff1eb294730fa92c57a08b2c40fb10196aaa7c8096f6b317615354d67936f9f

Download Submit
C:\Windows\SysWOW64\Ofnckp32.exe

Filesize
320KB

MD5
fb600d828ce1aee7f5d670da75e5373d

SHA1
5e1d7b525b3d6584a8b7c57e87eacc77e5f2fbb3

SHA256
1f3b7a94e0d432238ff38e0f6540d91320f1f2d7ccd82d23c13100678c454d8c

SHA512
eb7da90d4a8abf6379fb51c6dc5cd10d76c2ae1a910ef1a0c6e94697a3d5e9142127ba3599b6b7c53be0ab26142f31cccee53b063a21ca8cb55c29c088d0b75a

Download Submit
C:\Windows\SysWOW64\Ojaelm32.exe

Filesize
320KB

MD5
ed148396ada08449eba7b6adcf27bad5

SHA1
78789c63dd5ba6aa9fbcee76ba69fc86373a9236

SHA256
0610a5efd7e3e743c7b72eac116b570e22f7a279882d1d5d32c79eb8d6aaa36d

SHA512
3b6161ae5bb988d64a3faa5fadf1f1194f62f86b63191a25230f6c5d30f02c4a4eace339e769980bed445a67db7bfa68eca2b890da73debc10f863901c7e208c

Download Submit
C:\Windows\SysWOW64\Ojllan32.exe

Filesize
320KB

MD5
7b1c7f9991cc4be5dca92e7d2de523ab

SHA1
3f2441b8ee799c9493c87227caad070c5d56bfce

SHA256
ef65e4d02f4004b6150401492156eaa31b7e72641b49342fb464c7868797c058

SHA512
0813c34723964c43b890a2e2603354022ae2a73251b38285738184158f81d2fe755fb3377399cfcb1e46bc1bbe1c44a0dec7eb200d6c67c39543e495fecbb180

Download Submit
C:\Windows\SysWOW64\Ojoign32.exe

Filesize
320KB

MD5
92545dc34070592652e5d4b1647892c1

SHA1
9ef18673e5b00dafafa1fd73a95e3ae3cedff67c

SHA256
29016cddf4032663024b23004d3056245d00649817f4f46049550fc54e4a34eb

SHA512
2a39907c947df034ffd5ee046a88ba14b2074c43a767c87623e4c813d6d658f2a1489f5f1ad95167fa4603c29681f2e39619c977a31b12e3c560bedc872deb3c

Download Submit
C:\Windows\SysWOW64\Ojoign32.exe

Filesize
256KB

MD5
b440b0bc01b09a65a33ebe2e1f7e4fc9

SHA1
24fb0af05370843ed971e4640393cd645ebe00a0

SHA256
60239f267714c0c7179a7372afc76ba4c71d9780006ec651270c7dd02c0c2b3e

SHA512
1e4a46ffe7c62308926c8d8b2bb3e7df2ccf840fed118047e171323d12468f1daace7e629321724cc68f24625f94e7f5dd43ce4b1f14de0610ee17be0331bb88

Download Submit
C:\Windows\SysWOW64\Olhlhjpd.exe

Filesize
320KB

MD5
8e73a13534355d8ab3d9a8c13543485c

SHA1
3693d3f6fe2111d587a90242f35c6c8bc172913a

SHA256
eab14f0566882f95aa389b3cfa52896752c8c6569ef873b4a2be8003ef8b2656

SHA512
9fbc939c6705b3dbf11bc318e507febd2770319cb422e3a3c257cf2d0251af09ab79d25ac50e4ecfcc2330b8a4aa86fa89b9d7aacc3ab5385ede4659e2d71fdf

Download Submit
C:\Windows\SysWOW64\Oponmilc.exe

Filesize
320KB

MD5
c6d626bd0fee27df302a4daac4775a22

SHA1
df5ee572b2fafdbad6aa7aefcb0c440d6c53b643

SHA256
d91e7e53665f842cdea84fd6d0e7cd40155a378f1615f0880f26071011231d28

SHA512
dbf08324f9d410a000ebd699a521088006f5475b222f35a89516f721d8942bcc3447e2e6bd0ef2d432811ec53405c776388344a98dca03d43cd7fffe8e947956

Download Submit
C:\Windows\SysWOW64\Pdpmpdbd.exe

Filesize
320KB

MD5
280259ae510551cf7433621062462c45

SHA1
d102650bcf02d16be0402c87eb0ce3de6791b614

SHA256
9d24e1781bceefbbbef518fe5e3bbf10475343baa144fbdac0b977d216eee058

SHA512
5fa915831e7583b0f1c8d7130837703e2673a260b48a710ba439cc499b6b660e666ff78610028e32755ef3b409e78712232ff4ce8c9e85dd8cc82d874dcd4780

Download Submit
C:\Windows\SysWOW64\Pdpmpdbd.exe

Filesize
320KB

MD5
c27998c9b3703ca5a79fd9c2fdd96bf4

SHA1
af30485bfc2278f1afbeb857c2b26e3cb38b9bd0

SHA256
9632f032344727e7f4e01e7296f44449141c5d320ffb0c36cafa08e4895b167b

SHA512
dee86afaf221c894c2c86dc415db2708eb25619c14fcf861c296abad1a9ac689860ce49c52aa8d610043aeb3433d829a0ff58692f6b9695864cc2f96397ba465

Download Submit
C:\Windows\SysWOW64\Pfhfan32.exe

Filesize
320KB

MD5
109a38b57f0c1cf6187d758fb5bd3537

SHA1
4b2544f21a8d70d7e47a0617abb01d635fd3afdb

SHA256
8c581859a82e579390217ff86f5248a7146a5cdd416184a05bb852d0226499d6

SHA512
187b64f3c216574963bb84ab11962fac1638b92454e7afef48152f0892820955fd07bcc0eddcafd64523026e8374238b222a818ccadaf0df8e1be70216999b25

Download Submit
C:\Windows\SysWOW64\Pggbkagp.exe

Filesize
320KB

MD5
ed560fdff35b59a91dec7abaa8e79dc0

SHA1
8f1e62f278c3b2625a93597e8bdc443b6ee4ecb9

SHA256
4bd920cdeef794f455ef4aa720e5527471838ca967a064123f2f43edbc33a3b2

SHA512
6bb5b4089b37fd3e4271ac48b52463afb628e42d5fe97cccb182fb072f067bc9a0659961e0a7f68bda5a198211329038127f38d2aeb94a9737d8ca072fee573b

Download Submit
C:\Windows\SysWOW64\Pgioqq32.exe

Filesize
320KB

MD5
fee6487a1db8816beec98bc00a7219b7

SHA1
9530bfb07b45c3a4856a37b46bcb6bdfc5948600

SHA256
26053bed0c9295860d252f4b535fe08dfce552232aeee5374cdb11b4f90134d1

SHA512
f520f7d38a5053d4338c41cda94c500a00c25dbac49a789490332959e69b79cd24bd4abb5f1df88f7e6e7561b9b245f139e53e7137ec58a7831d62ab93e6a49c

Download Submit
C:\Windows\SysWOW64\Pgllfp32.exe

Filesize
320KB

MD5
0952f866ed94c5b46a9b7465ff0e5ddc

SHA1
c138d950366443bb6c983894f5489eaf00669aef

SHA256
c3dbdf9d4f1b907098736194df9cc25d7d18e43dc541f546cc58025233491a5a

SHA512
be1083e74d012302de5651049c1661cd2476ce2dad17c484b0e065ce4b3b04434e999a23bea43a03d5e00003821cefb0f29f0ce855a19d2edbe9c5803eda7d09

Download Submit
C:\Windows\SysWOW64\Pmfhig32.exe

Filesize
320KB

MD5
a51ad011f4663e83913b9e1a703401f1

SHA1
e338773ca4073cd2852b3eca9ff3cffa0820c0f9

SHA256
26b1c6a4e8f982b099a2e9ba7f0fc2b9105dcd3d7738bcf8c0edc6626bb6c7cb

SHA512
29198e97d6795661627a17b352e4e08dc319ad3c56d100f14a229a03811ce8b61075afeacdd3d3c51316a48b4100bb30ad7248ed5bff8497a384149f215c9172

Download Submit
C:\Windows\SysWOW64\Pnfdcjkg.exe

Filesize
320KB

MD5
f981b228141c23d7f5e32a27e62797d9

SHA1
98176ee46b0da20340b24135b4512bda0a897cc4

SHA256
f146ca59a101f29f053b4a1655eb3e5d8a825e2084de2c8a26aa2b917ac1b491

SHA512
c725938b6636f9f153ff07b6f63491194dd6acf3dc4cc020563ec801db00e5269b2e41fee1e869bc01e2376fada94615c70f4bb057f0dcd7f60543e4cd5ec6c3

Download Submit
C:\Windows\SysWOW64\Pqknig32.exe

Filesize
320KB

MD5
6ddaba47ca4f3a26d0694e08ae3fff67

SHA1
f93ecdd52f45783b8a0927a100b799730388567b

SHA256
5ed48801a9e3489ed677c8baf002227e752835a298a8d7a8cbef0fe12aa3c78b

SHA512
9e5c3a5b406a70ac35d55b5304c8065c8f3c13859742ff85971db66501caba29905da612ca54957e4f9e0b93b0504a86bff5eace59bd93e845b5aeb15f5131ff

Download Submit
C:\Windows\SysWOW64\Pqmjog32.exe

Filesize
320KB

MD5
0bc749d5a19131f6bdaebd473029a056

SHA1
0f01b2f6ed692ab1ebf64958b0c0a56a49ab4f9e

SHA256
21f08d63b47e2f8f01c1ad4a5122d60dca9a3b329400cd030dc5411c56667d73

SHA512
4958acef8bbb94cf6a1c6351ea8bbe7f07ea1aa35cb71d91233ad141dbc41d694627108868dd72bedb2bf9b77b0dcea065fe320d48e92313cf02ef89a395f8ec

Download Submit
C:\Windows\SysWOW64\Pqpgdfnp.exe

Filesize
320KB

MD5
ccdec728cd8d074fa0bc16c90aaf0175

SHA1
268edf2b6c729e6512c3e608fea8e4ecb67b0f1b

SHA256
f4f2383244bf27bd7ff1b46cf152be136d2e069dcd8186b1aed445616a901cd8

SHA512
06146ce32bc23935aba74ff5bbe4e72d6bc00e8bc66490b531d89c8e0d6b19106d01061cb16339f8b7330a9f90aa7ff16a398531cc665f92c23a8a49bb7fee84

Download Submit
C:\Windows\SysWOW64\Qcgffqei.exe

Filesize
320KB

MD5
430da535e9457272808c87a46473440c

SHA1
542708923ca1061d1e70ca3d194c1f31d79866ff

SHA256
b35f2b168b325720c0721483d234921b1f2d2400ecf3a0b87c1a3917a92a0b1e

SHA512
f9b27ca332418f94dc25775a1b1d412b134c8de9a13068660dce95573b2deb951934f63de44baa09c134aa38a67295765a1ef2834461bd22afdf385854714733

Download Submit
C:\Windows\SysWOW64\Qdbiedpa.exe

Filesize
320KB

MD5
4085f31491233d20b5d530c4150cb65d

SHA1
8953ecea9bf890a1f823aae02f9c9cf1f6714423

SHA256
b39fe0e53afa29bc95578fe855540e91f0f90ed0e00c2bc762c43d12ec6452fa

SHA512
b8ec886e1ed5dd59ff17225b673e7a97d3cfb3e85eeb2f2a8f8bd6c4b73ecafc60fc31db371c5f19f2b5ff09e95ee40f12a3b2639e647254a110c7581bdfd4ca

Download Submit
C:\Windows\SysWOW64\Qfcfml32.exe

Filesize
320KB

MD5
1bceca6e5c0731daf1e071d448e00de9

SHA1
ab3563b2b37d4a3fad10cd12ed49b7e0bb51b001

SHA256
d3728947c889cc0292397414323e7976a7abfdc10f4f183f402d0b3c68ccd308

SHA512
6ff965b7b3e75c8827af3e9cebe5025cc215b5820e35f00f5a493bf71f5456b3b894be28fdea46b9d6349837601ad8c63c926b1b5f878c07974859a16ca068dc

Download Submit
C:\Windows\SysWOW64\Qnhahj32.exe

Filesize
320KB

MD5
ba5f90391cd0ce883c557072fbf7ad64

SHA1
2181ec2f8b3ff93f60f3f0982352a4792a853bc8

SHA256
c9f909f9aa2268aeba600a5dc04651057e6079ae91cad32dc6def458d69897ec

SHA512
61d2af2d59c476743dcb853fd50084c1721d0acf409bda50693191621643b28db145ffca27de8e84599ae1a986c169d6fe59dad293ee9a92bfbf839acd77dd53

Download Submit
C:\Windows\SysWOW64\Qnjnnj32.exe

Filesize
320KB

MD5
a5cdfb19f5c97563cde5dbcd96b5e708

SHA1
22c0d2c6185396b64fee3265e78b9c8c7274bd7c

SHA256
c649456fd838b80d17261bb1e5abed9074300e0c57f58490052733f59bd2f0ec

SHA512
4b73f7482d057644d76cead2fccd9f15bb186d386341fa932508197408b0083459e756ec5748ddb9efaa97fc0544c5353ebb3b9f7213ce6357362b29e482d475

Download Submit
memory/316-581-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/316-47-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/348-467-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/440-406-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/652-436-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/760-568-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/852-533-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1104-183-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1128-255-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1152-328-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1232-352-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1264-554-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1276-346-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1440-584-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1440-575-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1460-412-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1528-448-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1556-128-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1568-95-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1820-119-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1828-239-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1852-540-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1892-370-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1920-298-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1948-103-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2068-64-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2156-583-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2156-582-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2196-168-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2200-334-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2204-262-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2208-574-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2208-39-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2272-503-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2324-460-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2412-223-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2508-316-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2652-215-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2912-208-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/2924-515-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3084-473-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3124-497-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3136-561-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3148-340-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3164-388-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3244-143-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3284-56-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3388-231-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3436-111-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3456-394-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3520-418-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3576-310-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3676-547-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3716-382-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3756-31-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3756-567-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3772-527-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3920-442-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3960-521-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3976-15-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/3976-553-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4020-135-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4024-72-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4056-430-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4060-175-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4100-491-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4212-7-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4212-546-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4224-191-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4236-485-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4372-280-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4448-274-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4452-358-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4464-292-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4488-151-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4500-23-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4500-560-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4516-286-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4544-400-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4580-322-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4628-479-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4644-364-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4664-159-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4672-376-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4832-461-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4888-268-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4900-424-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4940-199-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5004-79-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5020-247-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5028-509-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5032-304-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5044-454-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5056-0-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5056-539-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5072-87-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads